Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <000000000000a589d005fc52ee2d@google.com> <13528f21-0f36-4fa2-d34f-eecee6720bc1@linux.dev>
 <CAD=hENeCo=-Pk9TWnqxOWP9Pg-JXWk6n6J19gvPo9_h7drROGg@mail.gmail.com>
 <CAD=hENdoyBZaRz7aTy4mX5Kq1OYmWabx2vx8vPH0gQfHO1grzw@mail.gmail.com>
 <0d515e17-5386-61ba-8278-500620969497@linux.dev> <CAD=hENcqa0jQvLjuXw9bMtivCkKpQ9=1e0-y-1oxL23OLjutuw@mail.gmail.com>
 <CAD=hENdXdqfcxjNrNnP8CoaDy6sUJ4g5uxcWE0mj3HtNohDUzw@mail.gmail.com>
In-Reply-To: <CAD=hENdXdqfcxjNrNnP8CoaDy6sUJ4g5uxcWE0mj3HtNohDUzw@mail.gmail.com>
From:   Zhu Yanjun <zyjzyj2000@gmail.com>
Date:   Tue, 23 May 2023 13:18:30 +0800
Message-ID: <CAD=hENda4MxgEsgT-GUhYHH66m79wi8yxBQS8CYnxc_DsQKGwg@mail.gmail.com>
Subject: Re: [syzbot] [rdma?] INFO: trying to register non-static key in
 skb_dequeue (2)
To:     Guoqing Jiang <guoqing.jiang@linux.dev>
Cc:     syzbot <syzbot+eba589d8f49c73d356da@syzkaller.appspotmail.com>,
        jgg@ziepe.ca, leon@kernel.org, linux-kernel@vger.kernel.org,
        linux-rdma@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Tue, May 23, 2023 at 1:08=E2=80=AFPM Zhu Yanjun <zyjzyj2000@gmail.com> w=
rote:
>
> On Tue, May 23, 2023 at 12:29=E2=80=AFPM Zhu Yanjun <zyjzyj2000@gmail.com=
> wrote:
> >
> > On Tue, May 23, 2023 at 12:10=E2=80=AFPM Guoqing Jiang <guoqing.jiang@l=
inux.dev> wrote:
> > >
> > >
> > >
> > > On 5/23/23 12:02, Zhu Yanjun wrote:
> > > > On Tue, May 23, 2023 at 11:47=E2=80=AFAM Zhu Yanjun <zyjzyj2000@gma=
il.com> wrote:
> > > >> On Tue, May 23, 2023 at 10:26=E2=80=AFAM Guoqing Jiang <guoqing.ji=
ang@linux.dev> wrote:
> > > >>>
> > > >>>
> > > >>> On 5/23/23 10:13, syzbot wrote:
> > > >>>> Hello,
> > > >>>>
> > > >>>> syzbot tried to test the proposed patch but the build/boot faile=
d:
> > > >>>>
> > > >>>> failed to apply patch:
> > > >>>> checking file drivers/infiniband/sw/rxe/rxe_qp.c
> > > >>>> patch: **** unexpected end of file in patch
> > > >> This is not the root cause. The fix is not good.
> > > > This problem is about "INFO: trying to register non-static key. The
> > > > code is fine but needs lockdep annotation, or maybe"
> >
> > This warning is from "lock is not initialized". This is a
> > use-before-initialized problem.
> > The correct fix is to initialize the lock that is complained before it =
is used.
> >
> > Zhu Yanjun
>
> Based on the call trace, the followings are the order of this call trace.
>
> 291 /* called by the create qp verb */
> 292 int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp,
> struct rxe_pd *pd,
> 297 {
>             ...
> 317         rxe_qp_init_misc(rxe, qp, init);
>             ...
> 322
> 323         err =3D rxe_qp_init_resp(rxe, qp, init, udata, uresp);
> 324         if (err)
> 325                 goto err2;   <--- error
>
>             ...
>
> 334 err2:
> 335         rxe_queue_cleanup(qp->sq.queue); <--- Goto here
> 336         qp->sq.queue =3D NULL;
>
> In rxe_qp_init_resp, the error occurs before skb_queue_head_init.
> So this call trace appeared.

250 static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
254 {
                        ...
264
265                 type =3D QUEUE_TYPE_FROM_CLIENT;
266                 qp->rq.queue =3D rxe_queue_init(rxe, &qp->rq.max_wr,
267                                         wqe_size, type);
268                 if (!qp->rq.queue)
269                         return -ENOMEM;    <---Error here
270

...

282         skb_queue_head_init(&qp->resp_pkts); <-this is not called.
...
This will make spin_lock of resp_pkts is used before initialized.

Zhu Yanjun
>
> Zhu Yanjun
>
> > >
> > > Which is caused by  "skb_queue_head_init(&qp->resp_pkts)" is not call=
ed
> > > given rxe_qp_init_resp returns error, but the cleanup still trigger t=
he
> > > chain.
> > >
> > > rxe_qp_do_cleanup -> rxe_completer -> drain_resp_pkts ->
> > > skb_dequeue(&qp->resp_pkts)
> > >
> > > But I might misunderstood it ...
> > >
> > > Thanks,
> > > Guoqing